Minor point: there is a missing "+" in the first regular-expression example. After adding the "+", I was able to duplicate everything. I went to <https://yara.readthedocs.io/en/v3.8.1/writingrules.html>, and it didn't seem to mention xor not working with non-literal regular expressions. I am guessing a regular expression that can be treated as a string works as a string, so xor would work then. I think the documentation should clarify the intent.